Control: EC2 auto scaling group launch configurations should not have metadata response hop limit greater than 1
Description
This control checks the number of network hops that a metadata token can travel. The control fails if the metadata response hop limit is greater than 1.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.autoscaling_launch_config_hop_limit
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.autoscaling_launch_config_hop_limit --share
SQL
This control uses a named query:
select launch_configuration_arn as resource, case when metadata_options_put_response_hop_limit is null then 'ok' when metadata_options_put_response_hop_limit > 1 then 'alarm' else 'ok' end as status, case --If you do not specify a value, the hop limit default is 1. when metadata_options_put_response_hop_limit is null then title || ' metadata response hop limit set to default.' else title || ' has a metadata response hop limit of ' || metadata_options_put_response_hop_limit || '.' end as reason , region, account_idfrom aws_ec2_launch_configuration;